diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 946bd92c4..f670028b3 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -1,112 +1,355 @@ -##### -# INFISICAL K8 DEFAULT VALUES FILE -# PLEASE REPLACE VALUES/EDIT AS REQUIRED -##### +## @section Common parameters +## +## @param nameOverride Override release name +## nameOverride: "" +## @param fullnameOverride Override release fullname +## +fullnameOverride: "" + +## @section Infisical frontend parameters +## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes +## frontend: + ## @param frontend.enabled Enable frontend + ## + enabled: true + ## @param frontend.name Backend name + ## name: frontend + ## @param frontend.fullnameOverride Backend fullnameOverride + ## fullnameOverride: "" + ## @param frontend.podAnnotations Backend pod annotations + ## podAnnotations: {} + ## @param frontend.deploymentAnnotations Backend deployment annotations + ## deploymentAnnotations: {} + ## @param frontend.replicaCount Backend replica count + ## replicaCount: 2 + ## Backend image parameters + ## image: + ## @param frontend.image.repository Backend image repository + ## repository: infisical/frontend - pullPolicy: IfNotPresent + ## @param frontend.image.tag Backend image tag + ## tag: "latest" + ## @param frontend.image.pullPolicy Backend image pullPolicy + ## + pullPolicy: IfNotPresent + ## @param frontend.kubeSecretRef Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) + ## kubeSecretRef: "" service: - # type of the frontend service - type: ClusterIP - # define the nodePort if service type is NodePort - # nodePort: + ## @param frontend.service.annotations Backend service annotations + ## annotations: {} + ## @param frontend.service.type Backend service type + ## + type: ClusterIP + ## @param frontend.service.nodePort Backend service nodePort (used if above type is `NodePort`) + ## + nodePort: "" + +## Frontend variables configuration +## Documentation : https://infisical.com/docs/self-hosting/configuration/envars +## +frontendEnvironmentVariables: + ## @param frontendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) + ## + SITE_URL: infisical.local + +## @section Infisical backend parameters +## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes +## backend: + ## @param backend.enabled Enable backend + ## + enabled: true + ## @param backend.name Backend name + ## name: backend + ## @param backend.fullnameOverride Backend fullnameOverride + ## fullnameOverride: "" + ## @param backend.podAnnotations Backend pod annotations + ## podAnnotations: {} + ## @param backend.deploymentAnnotations Backend deployment annotations + ## deploymentAnnotations: {} + ## @param backend.replicaCount Backend replica count + ## replicaCount: 2 + ## Backend image parameters + ## image: + ## @param backend.image.repository Backend image repository + ## repository: infisical/backend - pullPolicy: IfNotPresent + ## @param backend.image.tag Backend image tag + ## tag: "latest" + ## @param backend.image.pullPolicy Backend image pullPolicy + ## + pullPolicy: IfNotPresent + ## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) + ## kubeSecretRef: "" service: + ## @param backend.service.annotations Backend service annotations + ## annotations: {} + ## @param backend.service.type Backend service type + ## + type: ClusterIP + ## @param backend.service.nodePort Backend service nodePort (used if above type is `NodePort`) + ## + nodePort: "" -mongodb: - enabled: true - name: "mongodb" - fullnameOverride: "mongodb" - nameOverride: "mongodb" - podAnnotations: {} - useStatefulSet: true - architecture: "standalone" - image: - repository: mongo - pullPolicy: IfNotPresent - tag: "6.0" - service: - annotations: {} - auth: - enabled: true - usernames: - - "infisical" - passwords: - - "infisical" - databases: - - "infisical" - persistence: - enabled: true - existingClaim: "" - resourcePolicy: "keep" - accessModes: ["ReadWriteOnce"] - size: 8Gi - volumePermissions: - enabled: true - args: - - "--dbpath=/bitnami/mongodb" - -# By default the backend will be connected to a Mongo instance in the cluster. -# However, it is recommended to add a managed document DB connection string because the DB instance in the cluster does not have persistence yet ( data will be deleted on next deploy). -# Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/ -mongodbConnection: - externalMongoDBConnectionString: "" - # externalMongoDBConnectionString: "mongodb://:@:/" - -ingress: - enabled: true - annotations: - kubernetes.io/ingress.class: "nginx" - # cert-manager.io/issuer: letsencrypt-nginx - hostName: infisical.local # replace with your domain - frontend: - path: / - pathType: Prefix - backend: - path: /api - pathType: Prefix - tls: [] - # - secretName: letsencrypt-nginx - # hosts: - # - k8.infisical.com - -frontendEnvironmentVariables: {} - +## Backend variables configuration +## Documentation : https://infisical.com/docs/self-hosting/configuration/envars +## backendEnvironmentVariables: - # MY_ENV_VAR: my-value - # Required keys for platform encryption/decryption ops. (128-bit hex value, 32-characters hex) - # e.g. 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' (from https://stackoverflow.com/a/34329057) + ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' + ## ENCRYPTION_KEY: MUST_REPLACE - # JWT (required secrets to sign JWT tokens) + ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' + ## JWT_SIGNUP_SECRET: MUST_REPLACE JWT_REFRESH_SECRET: MUST_REPLACE JWT_AUTH_SECRET: MUST_REPLACE - # Mail/SMTP (required to send emails) + JWT_SERVICE_SECRET: MUST_REPLACE + ## @param backendEnvironmentVariables.SMTP_HOST **Required** Hostname to connect to for establishing SMTP connections + ## @param backendEnvironmentVariables.SMTP_PORT Port to connect to for establishing SMTP connections + ## @param backendEnvironmentVariables.SMTP_SECURE If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported + ## @param backendEnvironmentVariables.SMTP_FROM_NAME Name label to be used in From field (e.g. Infisical) + ## @param backendEnvironmentVariables.SMTP_FROM_ADDRESS **Required** Email address to be used for sending emails (e.g. dev@infisical.com) + ## @param backendEnvironmentVariables.SMTP_USERNAME **Required** Credential to connect to host (e.g. team@infisical.com) + ## @param backendEnvironmentVariables.SMTP_PASSWORD **Required** Credential to connect to host + ## SMTP_HOST: MUST_REPLACE - SMTP_NAME: MUST_REPLACE + SMTP_PORT: 587 + SMTP_SECURE: false + SMTP_FROM_NAME: Infisical + SMTP_FROM_ADDRESS: MUST_REPLACE SMTP_USERNAME: MUST_REPLACE - SMTP_PASSWORD: MUST_REPLACE \ No newline at end of file + SMTP_PASSWORD: MUST_REPLACE + ## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) + ## + SITE_URL: infisical.local + +## @section MongoDB(®) parameters +## Documentation : https://github.com/bitnami/charts/blob/main/bitnami/mongodb/values.yaml +## + +mongodb: + ## @param mongodb.enabled Enable MongoDB(®) + ## + enabled: true + ## @param mongodb.name Name used to build variables (deprecated) + ## + name: "mongodb" + ## @param mongodb.fullnameOverride Fullname override + ## + fullnameOverride: "mongodb" + ## @param mongodb.nameOverride Name override + ## + nameOverride: "mongodb" + ## @param mongodb.podAnnotations Pod annotations + ## + podAnnotations: {} + ## @param mongodb.useStatefulSet Set to true to use a StatefulSet instead of a Deployment (only when `architecture: standalone`) + ## + useStatefulSet: true + ## @param mongodb.architecture MongoDB(®) architecture (`standalone` or `replicaset`) + ## + architecture: "standalone" + ## Bitnami MongoDB(®) image + ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/ + ## @param mongodb.image.repository MongoDB(®) image registry + ## @param mongodb.image.tag MongoDB(®) image tag (immutable tags are recommended) + ## @param mongodb.image.pullPolicy MongoDB(®) image pull policy + ## + image: + repository: bitnami/mongodb + pullPolicy: IfNotPresent + tag: "6.0.4-debian-11-r0" + ## @param mongodb.service.annotations Service annotations + ## + service: + annotations: {} + ## Infisical MongoDB custom authentication + ## + auth: + ## @param mongodb.auth.enabled Enable custom authentication + ## + enabled: true + ## @param mongodb.auth.usernames Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) + ## + usernames: + - "infisical" + ## @param mongodb.auth.passwords Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) + ## + passwords: + - "infisical" + ## @param mongodb.auth.databases Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) + ## + databases: + - "infisical" + ## MongoDB persistence configuration + ## + persistence: + ## @param mongodb.persistence.enabled Enable database persistence + ## + enabled: true + ## @param mongodb.persistence.existingClaim Existing persistent volume claim name + ## + existingClaim: "" + ## @param mongodb.persistence.resourcePolicy Keep the persistent volume even on deletion (`keep` or `""`) + ## + resourcePolicy: "keep" + ## @param mongodb.persistence.accessModes Persistent volume access modes + ## + accessModes: ["ReadWriteOnce"] + ## @param mongodb.persistence.size Persistent storage request size + ## + size: 8Gi + +## @param mongodbConnection.externalMongoDBConnectionString External MongoDB connection string +## By default the backend will be connected to a Mongo instance within the cluster +## However, it is recommended to add a managed document DB connection string for production-use (DBaaS) +## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/ +## e.g. "mongodb://:@:/" +## +mongodbConnection: + externalMongoDBConnectionString: "" + +## @section Ingress parameters +## + +ingress: + ## @param ingress.enabled Enable ingress + ## + enabled: true + annotations: + ## @skip ingress.annotations.kubernetes.io/ingress.class + ## + kubernetes.io/ingress.class: "nginx" + # cert-manager.io/issuer: letsencrypt-nginx + ## @param ingress.hostName Ingress hostname (your custom domain name) + ## Replace with your own domain + ## + hostName: infisical.local + ## @skip ingress.frontend + ## + frontend: + path: / + pathType: Prefix + ## @skip ingress.backend + ## + backend: + path: /api + pathType: Prefix + ## @param ingress.tls Ingress TLS hosts (matching above hostName) + ## Replace with your own domain + ## + tls: [] + # - secretName: letsencrypt-nginx + # hosts: + # - infisical.local + +## @section Mailhog parameters +## Documentation : https://github.com/codecentric/helm-charts/blob/master/charts/mailhog/values.yaml +## + +mailhog: + ## @param mailhog.enabled Enable Mailhog + ## + enabled: false + ## @param mailhog.fullnameOverride Fullname override + ## + fullnameOverride: "mailhog" + ## @param mailhog.nameOverride Name override + ## + nameOverride: "" + ## @param mailhog.image.repository Image repository + ## Why we use this version : https://github.com/mailhog/MailHog/issues/353#issuecomment-821137362 + ## @param mailhog.image.tag Image tag + ## @param mailhog.image.pullPolicy Image pull policy + ## + image: + repository: lytrax/mailhog + tag: "latest" + pullPolicy: IfNotPresent + + containerPort: + ## @param mailhog.containerPort.http.port Mailhog HTTP port (Web UI) + ## @skip mailhog.containerPort.http.name + ## + http: + name: http + port: 8025 + ## @param mailhog.containerPort.smtp.port Mailhog SMTP port (Mail) + ## @skip mailhog.containerPort.smtp.name + ## + smtp: + name: tcp-smtp + port: 1025 + ## @skip mailhog.service + ## + service: + annotations: {} + extraPorts: [] + clusterIP: "" + externalIPs: [] + loadBalancerIP: "" + loadBalancerSourceRanges: [] + type: ClusterIP + # Named target ports are not supported by GCE health checks, so when deploying on GKE + # and exposing it via GCE ingress, the health checks fail and the load balancer returns a 502. + namedTargetPort: true + port: + http: 8025 + smtp: 1025 + nodePort: + http: "" + smtp: "" + ## Mailhog ingress + ## + ingress: + ## @param mailhog.ingress.enabled Enable ingress + ## + enabled: true + ## @param mailhog.ingress.ingressClassName Ingress class name + ## + ingressClassName: nginx + ## @param mailhog.ingress.annotations Ingress annotations + ## + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + ## @param mailhog.ingress.labels Ingress labels + ## + labels: {} + hosts: + ## @param mailhog.ingress.hosts[0].host Mailhog host + ## + - host: mailhog.infisical.local + ## @skip mailhog.ingress.hosts[0].paths + ## + paths: + - path: "/" + pathType: Prefix \ No newline at end of file